Gootkit Malware Adopts New Tactics to Attack Healthcare and Finance Firms

Feb 09, 2023Ravie LakshmananThreat Intelligence / Malware

The Gootkit malware is prominently going after healthcare and
finance organizations in the U.S., U.K., and Australia, according
to new findings from Cybereason.

The cybersecurity firm said it investigated a Gootkit incident
in December 2022 that adopted a new method of deployment, with the
actors abusing the foothold to deliver Cobalt Strike^[1]
and SystemBC^[2]
for post-exploitation.

“The threat actor displayed fast-moving behaviors, quickly
heading to control the network it infected, and getting elevated
privileges in less than 4 hours,” Cybereason said^[3]
in an analysis published February 8, 2023.

Gootkit, also called Gootloader, is exclusively attributed to a
threat actor tracked by Mandiant as UNC2565. Starting its life in
2014 as a banking trojan, the malware has since morphed into a
loader capable of delivering next-stage payloads.

The shift in tactics was first uncovered^[4]
by Sophos in March 2021. Gootloader takes the form of
heavily-obfuscated JavaScript files that are served through
compromised WordPress sites ranked higher in search engine results
through poisoning techniques.

The attack chain relies on luring victims searching for
agreements and contracts on DuckDuckGo and Google to the
booby-trapped web page, ultimately leading to the deployment of
Gootloader.

The latest wave is also notable^[5]
for concealing^[6]
the malicious code within legitimate JavaScript libraries such as
jQuery, Chroma.js, Sizzle.js, and Underscore.js, which is then used
to spawn a secondary 40 MB JavaScript payload that establishes
persistence and launches the malware.

In the incident examined by Cybereason, the Gootloader infection
is said to have paved the way for Cobalt Strike and SystemBC to
conduct lateral movement and possible data exfiltration. The attack
was ultimately foiled.

The disclosure comes amid the ongoing trend of abusing Google Ads^[7]
by malware operators as an intrusion vector to distribute a variety
of malware such as FormBook, IcedID, RedLine, Rhadamanthys, and
Vidar.

The evolution of Gootloader into a sophisticated loader is
further reflective of how threat actors are constantly seeking new
targets and methods to maximize their profits by pivoting to a
malware-as-a-service (MaaS) model and selling that access to other
criminals.